VulnerabilityPublished 29 May 2025Updated 4 Jun 2025

CVE-2025-37994: Linux kernel · usb: typec: ucsi: displayport: Fix NULL pointer access

Affects Linux kernelSource CVE Database V5

Not known to be exploited.

Data as of 26 Oct 2026, 12:55 UTC

Severity

High

Rated High by the CNA (Linux) · No CVSS score from NVD or the CNA

EPSS: 0.2% chance of exploitation in 30 days – higher than 12% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 29 May 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

To mitigate CVE-2025-37994, European organizations should: 1) Apply the official Linux kernel patch that addresses the NULL pointer dereference in the UCSI DisplayPort workqueue as soon as it is available and tested in their environment. 2) Monitor Linux kernel updates from trusted sources and ensure timely deployment of security patches, especially for kernels used in production and critical systems. 3) For systems where immediate patching is not feasible, consider disabling USB Type-C DisplayPort functionality if it is not required, to reduce the attack surface. 4) Implement robust system monitoring to detect kernel panics or crashes that could indicate attempted exploitation. 5) Employ kernel hardening techniques and security modules (e.g., SELinux, AppArmor) to limit the impact of kernel-level faults. 6) Maintain comprehensive backups and recovery plans to minimize downtime in case of system crashes. 7) Engage in vulnerability scanning and penetration testing focused on USB and kernel interfaces to proactively identify potential exploitation attempts.

Description

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix NULL pointer access This patch ensures that the UCSI driver waits for all pending tasks in the ucsi_displayport_work workqueue to finish executing before proceeding with the partner removal.

Impact

For European organizations, the impact of CVE-2025-37994 could be significant depending on their reliance on Linux-based systems, especially those using USB Type-C ports for DisplayPort functionality. A successful exploitation would likely cause a denial of service (DoS) condition through a kernel panic or system crash, leading to potential downtime and disruption of critical services. This could affect servers, workstations, and embedded devices running vulnerable Linux kernels. While the vulnerability does not appear to allow privilege escalation or remote code execution directly, the resulting instability could be leveraged in multi-stage attacks or cause operational disruptions. Organizations in sectors such as finance, manufacturing, telecommunications, and critical infrastructure that use Linux extensively might experience operational interruptions. Additionally, environments with high availability requirements or those using Linux in embedded or IoT devices with USB Type-C ports could face increased risk. The absence of known exploits reduces immediate threat but does not eliminate the risk of future exploitation once the vulnerability details become widely known.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 7 Jul 2025, 19:56 UTC

Technical details

References

Community reviews

Related threats